amazon-web-services - 如何使用 Terraform 刷新 API Gateway 的 AWS Lambda 权限？

Question

我正在使用 Terraform 部署 REST API 网关。几个端点正在访问 Lambda 函数以返回响应。每当我使用 terraform 部署 api-gw 时，Lambda 权限似乎都不会刷新，我必须在 AWS 控制台中手动打开 api-gw 门户，然后再次添加提示我允许调用操作的 lambda 函数帖子。如何在无需执行这些手动步骤的情况下刷新权限？我正在使用以下代码段进行 api-gw 部署和 lambda 权限：

resource "aws_api_gateway_deployment" "deploy" {
  rest_api_id = aws_api_gateway_rest_api.apigw.id
  stage_name  = ""
  variables  = {
    deployed_at = timestamp()
  }
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_lambda_permission" "customers_lambda_permission" {
  statement_id  = "AllowDemoAPIInvokeProjectGet"
  action        = "lambda:InvokeFunction"
  function_name = local.lambda_name
  principal     = "apigateway.amazonaws.com"
  source_arn = "${aws_api_gateway_rest_api.apigw.execution_arn}/*/GET/api/customers"

}

标签： amazon-web-servicesaws-lambdaterraformaws-api-gatewayterraform-provider-aws

Answer 1

您的aws_api_gateway_deployment资源应该依赖于aws_api_gateway_integrationlambda 集成，以便在部署之前创建。

resource "aws_api_gateway_deployment" "deploy" {
  ...
  depends_on = [
    aws_api_gateway_integration.example1,
    aws_api_gateway_integration.example2
  ]
}

或使用触发器属性：

resource "aws_api_gateway_deployment" "deploy" {
  ...
  triggers = {
    redeployment = sha1(jsonencode([
      aws_api_gateway_resource.example1.id,
      aws_api_gateway_method.example1.id,
      aws_api_gateway_integration.example1.id,
    ]))
}